Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,467

CVE-2021-23377

Arbitrary Command Injection

This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Onion-oled-js Project
Products
Onion-oled-js
CVE-2021-23376

Arbitrary Command Injection

This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Ffmpegdotjs Project
Products
Ffmpegdotjs
CVE-2021-23375

Arbitrary Command Injection

This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 7.3 High EPSS 1.3% KEV · Not listed
Vendors
Psnode Project
Products
Psnode
CVE-2021-23374

Arbitrary Command Injection

This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 7.3 High EPSS 1.3% KEV · Not listed
Vendors
Ps-visitor Project
Products
Ps-visitor
CVE-2021-23372

Denial of Service (DoS)

All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mongo-express Project
Products
Mongo-express
CVE-2021-23371

Regular Expression Denial of Service (ReDoS)

This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Chrono-node Project
Products
Chrono-node
CVE-2021-23370

Prototype Pollution

This affects the package swiper before 6.5.1.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Swiperjs
Products
Swiper
CVE-2021-23368

Regular Expression Denial of Service (ReDoS)

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

CVSS 3.1 · 5.3 Medium EPSS 3.5% KEV · Not listed
Vendors
Postcss Redhat
Products
Postcss Acm Openshift and 1 more
CVE-2021-23365

Authentication Bypass

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data).

CVSS 3.1 · 4.8 Medium EPSS 1.0% KEV · Not listed
Vendors
Tyk
Products
Tyk-identity-broker
CVE-2021-23364

Regular Expression Denial of Service (ReDoS)

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

CVSS 3.1 · 5.3 Medium EPSS 2.4% KEV · Not listed
Vendors
Browserslist Project Redhat
Products
Browserslist Acm Quay
CVE-2021-23363

Arbitrary Command Injection

This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

CVSS 3.1 · 6.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Kill-by-port Project
Products
Kill-by-port
CVE-2021-23362

Regular Expression Denial of Service (ReDoS)

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

CVSS 3.1 · 5.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Npmjs Redhat Siemens
Products
Hosted-git-info Acm Enterprise Linux and 4 more
CVE-2021-23360

Arbitrary Command Injection

This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Killport Project
Products
Killport
CVE-2021-23359

Arbitrary Command Injection

This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Port-killer Project
Products
Port-killer
CVE-2021-23357

Directory Traversal

All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this value is then used to create a file on disk. If there is a file found with the same name then it will be deleted and then re-created with the contents of the API creation request.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Tyk
Products
Tyk
CVE-2021-23356

Arbitrary Command Injection

This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file.

CVSS 3.1 · 5.6 Medium EPSS 1.1% KEV · Not listed
Vendors
Kill-process-by-name Project
Products
Kill-process-by-name
CVE-2021-23355

Arbitrary Command Injection

This affects all versions of package ps-kill. If (attacker-controlled) user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file. PoC (provided by reporter): var ps_kill = require('ps-kill'); ps_kill.kill('$(touch success)',function(){});

CVSS 3.1 · 5.6 Medium EPSS 1.2% KEV · Not listed
Vendors
Ps-kill Project
Products
Ps-kill
CVE-2021-23354

Regular Expression Denial of Service (ReDoS)

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.

CVSS 3.1 · 5.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Adaltas
Products
Printf
CVE-2021-23353

Regular Expression Denial of Service (ReDoS)

This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.

CVSS 3.1 · 5.9 Medium EPSS 2.6% KEV · Not listed
Vendors
Parall
Products
Jspdf